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We develop a new technique called buffer merging for reducing memory requirements of 
synchronous dataflow (SDF) specifications. SDF has proven to be an attractive model for 
specifying DSP systems, and is used in many commercial tools like System Canvas, SPW, 
and Cocenthc. Good synthesis from an SDF specification depends crucially on scheduling, 
and memory is an important metric for generating efficient schedules. Previous techniques 
on memory minimization have either not considered buffer shari ... 
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Dataflow architectures tolerate long unpredictable communication delays and support 
generation and coordination of parallel activities directly in hardware, rather than 
assuming that program mapping will cause these issues to disappear. However, the 
proposed mechanisms are complex and introduce new mapping complications. This paper 
presents a greatly simplified approach to dataflow execution, called the explicit token store 
(ETS) architecture, and its current realization in ... 
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Computational e-mail systems, which allow mail messages to contain command scripts 
that. automatically execute upon receipt, can be used as a basis for building a variety of 
collaborative applications. However, their use also presents a serious security problem 
because a command script from a sender may access/modify receiver's private files or 
execute applications on receiver's behalf. Existing solutions to the problem eitlier severely 
restrict I/O capability of scripts, limiting the range o ... 
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This paper discusses an experiment which sets out to Improve the performance of a 
number of single user computers which rely on a general purpose file server for their filing 
systems. The background is described in detail in reference [1], but for completeness it is 
necessary to say something about it here. The Cambridge Distributed Computing System 
consists, at the time of writing, of between 50 and 60 machines of various types, 
connected by a digital communications ring. On the ... 
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We introduce a transformation system for concurrent constraint programming (CCP). We 
define suitable applicability conditions for the transformations that guarantee the 
input/output CCP semantics is also preserved when distinguishing deadlocked 
computations from successful ones and when considering intermediate results of (possibly) 
nonterminating computations.The system allows us to optimize CCP programs while 
preserving their intended meaning: In addition to the usual benefits for sequential d ... 
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The increasing number of software-based attacks has attracted substantial efforts to 
prevent applications from malicious interference. For example, Trusted Computing (TC) 
technologies have been recently proposed to provide strong isolation on application 
platforms. On the other hand, today pervasively available computing cycles and data 
resources have enabled various distributed applications thatjequire collaboration among 
different application processes. These two conflicting trends grow in ... 
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This paper presents the access control mechanisms in Windows 2000 that enable fine- 
grained protection and centralized management. These mechanisms were added during 
the transition from Windows NT 4.0 to support the Active Directory, a new feature in 
Windows 2000. We first extended entries in access control lists to allow rights to apply to 
just a portion of an object. The second extension allows centralized management of object 
hierarchies by specifying more precisely how access control lis ... 
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Synchronous Dataflow, a subset of dataflow, has proven to be a good match for specifying 
DSP programs. Because of the limited amount of memory in embedded DSPs, a key 
problem during software synthesis from SDF specifications is the minimization of the 
memory used by the target code. We develop a powerful formal technique called buffer 
merging that attempts to overlay buffers in the SDF graph systematically in order to 
drastically reduce data buffering requirements. We give a polynomial-time algo ... 
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Policy enforcement is an integral part of many applications. Policies are often used to 
control access to sensitive information. Current policy specification languages give users 
fine-grained control over when and how information can be accessed, and are flexible 
enough to be used in a variety of applications. Evaluation of these policies, however, is not 
optimized for performance. Emerging applications, such as real-time enforcement of 
privacy policies in a sensor network or location-aware comp ... 
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One way to show that a system is not secure is to demonstrate that a malicious or 
mistake-prone user or program can break security by causing the system to reach a 
nonsecure state. A fundamental aspect of a security model is a proof that validates that 
every state reachable from a secure initial state is secure. A sequential security model 
assumes that every command that acts as a state transition executes sequentially, while a 
concurrent security model assumes that multiple commands execut ... 

Keywords: access control, concurrency control, distributed system security, operating 
system security, protection model 
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This article presents the deign and implementation of the recovery scheme in Calypso. 
Calypso is a cluster-optimized, distributed file system for UNIX clusters. As in Sprite and 
AFS, Calypso servers are stateful and scale well to a large number of clients. The recovery 
scheme in Calypso Is nondisruptive, meaning that open files remain open, client modified 
data are saved, and in-flight operations are properly handled across server recover. The 
scheme uses distributed state amount the client ... 

Keywords: Calypso, cluster systems, distributed state, state reconstruction 
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MPI-IO/GPFS is an optimized prototype implementation of the I/O chapter of the Message 
Passing Interface (MPI) 2 standard. It uses the IBM General Parallel File System (GPFS) 
Release 3 as the underlying file system. This paper describes optimization features of the 
prototype that take advantage of new GPFS programming interfaces. It also details how 
collective data access operations have been optimized by minimizing the number of 
messages exchanged in sparse accesses and by increasing the overia ... 

Keywords: GPFS, MPI-IO, SMP node, benchmark, data shipping, double buffering, file 
hints, optimization, performance, prefetching 
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There are many situations where more than one principal needs to give authorisation so 
that a single function can take place. Self-Authenticating Proxies provide a mechanism 
which may be suitably employed to support the requirements of joint authorisation. 
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This paper presents several low-latency mixed-timing FIFO designs that interface systems 
on a chip working at different speeds. The connected systems can be either synchronous 
or asynchronous. The design are then adapted to work between systems with very long 
interconnection delays, by migrating a single-clock solution by Carloni et al. (for ''latency- 
insensitive" protocols) to mixed-timing domains. The new designs can be made arbitrarily 
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This article presents the mechanisms in Windows 2000 that enable fine-grained and 
centrally managed access control for both operating system components and applications. 
These features were added during the transition from Windows NT 4.0 to support the 
Active Directory, a new feature in Windows 2000, and to protect computers connected to 
the Internet. While the access control mechanisms in Windows NT are suitable for file 
systems and applications with simple requirements, they fall short of the ... 
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We present netra, a tool for systematically analyzing and detecting explicit information- 
flow vulnerabilities in access-control configurations. Our tool takes a snapshot of the 
access-control metadata, and performs static analysis on this snapshot. We devise an 
augmented relational calculus that naturally models both access control mechanisms and 
information-flow policies uniformly. This calculus is Interpreted as a logic program, with a 
fixpoint semantics similar to Datalog, and produc ... 

Keywords: privilege escalation, static analysis, vulnerability reports 
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